Intrusion resistant implantable medical device

ABSTRACT

Provided embodiments include a device, apparatus, system, computer program product, and method. A medical apparatus is provided. At least a portion of which is configured for implantation in an animal. The medical apparatus includes a communication module configured to receive communications originating external to the animal. The medical apparatus also includes a threat assessment module configured to ascertain a threat characteristic of a communication received by the communication module. The medical apparatus further includes a threat mitigation module configured to implement a mitigation measure responsive to the ascertained threat characteristic of the received communication.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is related to and claims the benefit of theearliest available effective filing date(s) from the following listedapplication(s) (the “Related Applications”) (e.g., claims earliestavailable priority dates for other than provisional patent applicationsor claims benefits under 35 USC § 119(e) for provisional patentapplications, for any and all parent, grandparent, great-grandparent,etc. applications of the Related Application(s)).

RELATED APPLICATIONS

For purposes of the USPTO extra-statutory requirements, the presentapplication constitutes a continuation-in-part of United States patentapplication No. To be assigned, entitled SECURE OPERATION OF IMPLANTEDDEVICE, naming Roderick A. Hyde, Muriel Y. Ishikawa, Eric C. Leuthardt,Michael A. Smith, and Lowell L. Wood, Jr. as inventors, filed Apr. 30,2008, which is currently co-pending, or is an application of which acurrently co-pending application is entitled to the benefit of thefiling date.

The United States Patent Office (USPTO) has published a notice to theeffect that the USPTO's computer programs require that patent applicantsreference both a serial number and indicate whether an application is acontinuation or continuation-in-part. Stephen G. Kunin, Benefit ofPrior-Filed Application, USPTO Official Gazette Mar. 18, 2003, availableat http://www.uspto.gov/web/offices/com/sol/og/2003/week 11/patbene.htm.The present Applicant Entity (hereinafter “Applicant”) has providedabove a specific reference to the application(s) from which priority isbeing claimed as recited by statute. Applicant understands that thestatute is unambiguous in its specific reference language and does notrequire either a serial number or any characterization, such as“continuation” or “continuation-in-part,” for claiming priority to U.S.patent applications. Notwithstanding the foregoing, Applicantunderstands that the USPTO's computer programs have certain data entryrequirements, and hence Applicant is designating the present applicationas a continuation-in-part of its parent applications as set forth above,but expressly points out that such designations are not to be construedin any way as any type of commentary and/or admission as to whether ornot the present application contains any new matter in addition to thematter of its parent application(s).

All subject matter of the Related Applications and of any and allparent, grandparent, great-grandparent, etc. applications of the RelatedApplications is incorporated herein by reference to the extent suchsubject matter is not inconsistent herewith.

SUMMARY

An embodiment provides a medical apparatus. At least a portion of themedical apparatus is configured for implantation in an animal. Themedical apparatus includes a communication module configured to receivecommunications originating external to the animal. The medical apparatusalso includes a threat assessment module configured to ascertain athreat characteristic of a communication received by the communicationmodule. The medical apparatus further includes a threat mitigationmodule configured to implement a mitigation measure responsive to theascertained threat characteristic of the received communication. In analternative embodiment, the medical apparatus includes a patient moduleconfigured to engage a physiological aspect of the animal. In anotherembodiment, the medical apparatus includes a biocompatible housingadapted to be implanted in an animal. In another embodiment, the medicalapparatus also includes a power source providing operational power to atleast a portion of the medical apparatus. In another embodiment, themedical apparatus includes a backdoor module configured to respond to acommand received from a trusted or a verified third party without regardto the implemented mitigation measure responsive to the ascertainedthreat characteristic of the received communication. In addition to theforegoing, other embodiments are described in the claims, drawings, andtext that form a part of the present application.

Another embodiment provides a method. The method is implemented in amedical apparatus implanted in an animal and configured to at least oneof transmit or receive a communication originating external to theanimal. The method includes receiving a communication. The method alsoincludes detecting an indication of a malware in the receivedcommunication. The method further includes implementing in the implantedmedical device a countermeasure responsive to the detected indication ofmalware in the received communication. In an alternative embodiment, themethod further includes initiating a transmission of an attacknotification in response to the indication of malware in the receivedcommunication. In addition to the foregoing, other embodiments aredescribed in the claims, drawings, and text that form a part of thepresent application.

A further embodiment provides a computer program product. The computerprogram product includes a computer-readable signal-bearing mediumbearing program instructions. The program instructions are configured toperform a process in a computing device of an animal-implantable medicalapparatus. The process includes receiving a communication originated bya source external to the animal. The process also includes detecting anindication of a malware in the received communication. The processfurther includes implementing in the implanted medical apparatus acountermeasure responsive to the detected indication of malware in thereceived communication. In addition to the foregoing, other embodimentsare described in the claims, drawings, and text that form a part of thepresent application.

An embodiment provides a medical device. The medical device isconfigured for implantation in a living subject. The medical deviceincludes means for at least one of receiving or transmitting acommunication outside of the living subject. The medical device alsoincludes means for detecting an indication of a malware in a receivedcommunication. The medical device further includes means forimplementing in an element of the implanted medical device acountermeasure responsive to the detected indication of malware in thereceived communication. In an alternative embodiment, the medical devicefurther includes means for engaging a physiological aspect of the livingsubject. In addition to the foregoing, other embodiments are describedin the claims, drawings, and text that form a part of the presentapplication.

The foregoing summary is illustrative only and is not intended to be inany way limiting. In addition to the illustrative aspects, embodiments,and features described above, further aspects, embodiments, and featureswill become apparent by reference to the drawings and the followingdetailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an example embodiment of a thin computing device inwhich embodiments may be implemented;

FIG. 2 illustrates an example embodiment of a general-purpose computingsystem in which embodiments may be implemented;

FIG. 3 illustrates an example environment in which embodiments may beimplemented;

FIG. 4 illustrates another example environment in which embodiments maybe implemented;

FIG. 5 illustrates an example of an operational flow implemented in anenvironment;

FIG. 6 illustrates an alternative embodiment of the operational flow ofFIG. 5

FIG. 7 illustrates another alternative embodiment of the operationalflow of FIG. 5;

FIG. 8 illustrates a further alternative embodiment of the operationalflow of FIG. 5;

FIG. 9 illustrates an alternative embodiment of the operational flow ofFIG. 5;

FIG. 10 illustrates an example computer program product; and

FIG. 11 illustrates an example system in which embodiments may beimplemented.

DETAILED DESCRIPTION

In the following detailed description, reference is made to theaccompanying drawings, which form a part hereof. In the drawings,similar symbols typically identify similar components, unless contextdictates otherwise. The illustrated embodiments described in thedetailed description, drawings, and claims are not meant to be limiting.Other embodiments may be utilized, and other changes may be made,without departing from the spirit or scope of the subject matterpresented here.

FIG. 1 and the following discussion are intended to provide a brief,general description of an environment in which embodiments may beimplemented. FIG. 1 illustrates an example system that includes a thincomputing device 20, which may be included in an electronic device thatalso includes a device functional element 50. For example, theelectronic device may include any item having electrical and/orelectronic components playing a role in a functionality of the item,such as a limited resource computing device, a wireless communicationdevice, a mobile wireless communication device, an electronic pen, ahandheld electronic writing device, a digital camera, a scanner, anultrasound device, an x-ray machine, a non-invasive imaging device, acell phone, a PDA, a Blackberry® device, a printer, a refrigerator, acar, and an airplane. In another example, the thin computing device maybe included in an implantable medical apparatus or device. In a furtherexample, the thin computing device may be operable to communicate withan implantable or implanted medical apparatus.

The thin computing device 20 includes a processing unit 21, a systemmemory 22, and a system bus 23 that couples various system componentsincluding the system memory 22 to the processing unit 21. The system bus23 may be any of several types of bus structures including a memory busor memory controller, a peripheral bus, and a local bus using any of avariety of bus architectures. The system memory includes read-onlymemory (ROM) 24 and random access memory (RAM) 25. A basic input/outputsystem (BIOS) 26, containing the basic routines that help to transferinformation between sub-components within the thin computing device 20,such as during start-up, is stored in the ROM 24. A number of programmodules may be stored in the ROM 24 and/or RAM 25, including anoperating system 28, one or more application programs 29, other programmodules 30 and program data 31.

A user may enter commands and information into the computing device 20through input devices, such as a number of switches and buttons,illustrated as hardware buttons 44, connected to the system via asuitable interface 45. Input devices may further include atouch-sensitive display with suitable input detection circuitry,illustrated as a display 32 and screen input detector 33. The outputcircuitry of the touch-sensitive display 32 is connected to the systembus 23 via a video driver 37. Other input devices may include amicrophone 34 connected through a suitable audio interface 35, and aphysical hardware keyboard (not shown). Output devices may include atleast one the display 32, or a projector display 36.

In addition to the display 32, the computing device 20 may include otherperipheral output devices, such as at least one speaker 38. Otherexternal input or output devices 39, such as a joystick, game pad,satellite dish, scanner or the like may be connected to the processingunit 21 through a USB port 40 and USB port interface 41, to the systembus 23. Alternatively, the other external input and output devices 39may be connected by other interfaces, such as a parallel port, game portor other port. The computing device 20 may further include or be capableof connecting to a flash card memory (not shown) through an appropriateconnection port (not shown). The computing device 20 may further includeor be capable of connecting with a network through a network port 42 andnetwork interface 43, and through wireless port 46 and correspondingwireless interface 47 may be provided to facilitate communication withother peripheral devices, including other computers, printers, and so on(not shown). It will be appreciated that the various components andconnections shown are examples and other components and means ofestablishing communication links may be used.

The computing device 20 may be primarily designed to include a userinterface. The user interface may include a character, a key-based,and/or another user data input via the touch sensitive display 32. Theuser interface may include using a stylus (not shown). Moreover, theuser interface is not limited to an actual touch-sensitive panelarranged for directly receiving input, but may alternatively or inaddition respond to another input device such as the microphone 34. Forexample, spoken words may be received at the microphone 34 andrecognized. Alternatively, the computing device 20 may be designed toinclude a user interface having a physical keyboard (not shown).

The device functional elements 50 are typically application specific andrelated to a function of the electronic device, and is coupled with thesystem bus 23 through an interface (not shown). The functional elementsmay typically perform a single well-defined task with little or no userconfiguration or setup, such as a refrigerator keeping food cold, a cellphone connecting with an appropriate tower and transceiving voice ordata information, a camera capturing and saving an image, an implantablemedical apparatus.

In certain instances, one or more elements of the thin computing device20 may be deemed not necessary and omitted. In other instances, one ormore other elements may be deemed necessary and added to the thincomputing device.

FIG. 2 illustrates an example embodiment of a general-purpose computingsystem in which embodiments may be implemented, shown as a computingsystem environment 100. Components of the computing system environment100 may include, but are not limited to, a computing device 110 having aprocessing unit 120, a system memory 130, and a system bus 121 thatcouples various system components including the system memory to theprocessing unit 120. The system bus 121 may be any of several types ofbus structures including a memory bus or memory controller, a peripheralbus, and a local bus using any of a variety of bus architectures. By wayof example, and not limitation, such architectures include IndustryStandard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus,Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA)local bus, and Peripheral Component Interconnect (PCI) bus, also knownas Mezzanine bus.

The computing system environment 100 typically includes a variety ofcomputer-readable media products. Computer-readable media may includeany media that can be accessed by the computing device 110 and includeboth volatile and nonvolatile media, removable and non-removable media.By way of example, and not of limitation, computer-readable media mayinclude computer storage media and communication media.

Computer storage media includes volatile and nonvolatile, removable andnon-removable media implemented in any method or technology for storageof information such as computer-readable instructions, data structures,program modules, or other data. Computer storage media includes, but isnot limited to, random-access memory (RAM), read-only memory (ROM),electrically erasable programmable read-only memory (EEPROM), flashmemory, or other memory technology, CD-ROM, digital versatile disks(DVD), or other optical disk storage, magnetic cassettes, magnetic tape,magnetic disk storage, or other magnetic storage devices, or any othermedium which can be used to store the desired information and which canbe accessed by the computing device 110. In a further embodiment, acomputer storage media may include a group of computer storage mediadevices. In another embodiment, a computer storage media may include aninformation store. In another embodiment, an information store mayinclude a quantum memory, a photonic quantum memory, and/or atomicquantum memory. Combinations of any of the above may also be includedwithin the scope of computer-readable media.

Communication media may typically embody computer-readable instructions,data structures, program modules, or other data in a modulated datasignal such as a carrier wave or other transport mechanism and includeany information delivery media. The term “modulated data signal” means asignal that has one or more of its characteristics set or changed insuch a manner as to encode information in the signal. By way of example,and not limitation, communication media include wired media, such as awired network and a direct-wired connection, and wireless media such asacoustic, RF, optical, and infrared media.

The system memory 130 includes computer storage media in the form ofvolatile and nonvolatile memory such as ROM 131 and RAM 132. A RAM mayinclude at least one of a DRAM, an EDO DRAM, a SDRAM, a RDRAM, a VRAM,and/or a DDR DRAM. A basic input/output system (BIOS) 133, containingthe basic routines that help to transfer information between elementswithin the computing device 110, such as during start-up, is typicallystored in ROM 131. RAM 132 typically contains data and program modulesthat are immediately accessible to or presently being operated on byprocessing unit 120. By way of example, and not limitation, FIG. 2illustrates an operating system 134, application programs 135, otherprogram modules 136, and program data 137. Often, the operating system134 offers services to applications programs 135 by way of one or moreapplication programming interfaces (APIs) (not shown). Because theoperating system 134 incorporates these services, developers ofapplications programs 135 need not redevelop code to use the services.Examples of APIs provided by operating systems such as Microsoft's“WINDOWS” are well known in the art.

The computing device 110 may also include other removable/non-removable,volatile/nonvolatile computer storage media products. By way of exampleonly, FIG. 2 illustrates a non-removable non-volatile memory interface(hard disk interface) 140 that reads from and writes for example tonon-removable, non-volatile magnetic media. FIG. 2 also illustrates aremovable non-volatile memory interface 150 that, for example, iscoupled to a magnetic disk drive 151 that reads from and writes to aremovable, non-volatile magnetic disk 152, and/or is coupled to anoptical disk drive 155 that reads from and writes to a removable,non-volatile optical disk 156, such as a CD ROM. Otherremovable/nonremovable, volatile/non-volatile computer storage mediathat can be used in the example operating environment include, but arenot limited to, magnetic tape cassettes, memory cards, flash memorycards, DVDs, digital video tape, solid state RAM, and solid state ROM.The hard disk drive 141 is typically connected to the system bus 121through a non-removable memory interface, such as the interface 140, andmagnetic disk drive 151 and optical disk drive 155 are typicallyconnected to the system bus 121 by a removable non-volatile memoryinterface, such as interface 150.

The drives and their associated computer storage media discussed aboveand illustrated in FIG. 2 provide storage of computer-readableinstructions, data structures, program modules, and other data for thecomputing device 110. In FIG. 2, for example, hard disk drive 141 isillustrated as storing an operating system 144, application programs145, other program modules 146, and program data 147. Note that thesecomponents can either be the same as or different from the operatingsystem 134, application programs 135, other program modules 136, andprogram data 137. The operating system 144, application programs 145,other program modules 146, and program data 147 are given differentnumbers here to illustrate that, at a minimum, they are differentcopies.

A user may enter commands and information into the computing device 110through input devices such as a microphone 163, keyboard 162, andpointing device 161, commonly referred to as a mouse, trackball, ortouch pad. Other input devices (not shown) may include at least one of atouch sensitive display, joystick, game pad, satellite dish, andscanner. These and other input devices are often connected to theprocessing unit 120 through a user input interface 160 that is coupledto the system bus, but may be connected by other interface and busstructures, such as a parallel port, game port, or a universal serialbus (USB).

A display 191, such as a monitor or other type of display device orsurface may be connected to the system bus 121 via an interface, such asa video interface 190. A projector display engine 192 that includes aprojecting element may be coupled to the system bus. In addition to thedisplay, the computing device 110 may also include other peripheraloutput devices such as speakers 197 and printer 196, which may beconnected through an output peripheral interface 195.

The computing system environment 100 may operate in a networkedenvironment using logical connections to one or more remote computers,such as a remote computer 180. The remote computer 180 may be a personalcomputer, a server, a router, a network PC, a peer device, or othercommon network node, and typically includes many or all of the elementsdescribed above relative to the computing device 110, although only amemory storage device 181 has been illustrated in FIG. 2. The networklogical connections depicted in FIG. 2 include a local area network(LAN) and a wide area network (WAN), and may also include other networkssuch as a personal area network (PAN) (not shown). Such networkingenvironments are commonplace in offices, enterprise-wide computernetworks, intranets, and the Internet.

When used in a networking environment, the computing system environment100 is connected to the network 171 through a network interface, such asthe network interface 170, the modem 172, and/or the wireless interface193. The network may include a LAN network environment, and/or a WANnetwork environment, such as the Internet. In a networked environment,program modules depicted relative to the computing device 110, orportions thereof, may be stored in a remote memory storage device. Byway of example, and not limitation, FIG. 2 illustrates remoteapplication programs 185 as residing on computer storage medium 181. Itwill be appreciated that the network connections shown are examples andother means of establishing communication link between the computers maybe used.

In certain instances, one or more elements of the computing device 110may be deemed not necessary and omitted. In other instances, one or moreother elements may be deemed necessary and added to the computingdevice.

FIG. 3 illustrates an example environment 200 in which embodiments maybe implemented. The environment includes a medical apparatus 210, atleast a portion of which is configured for implantation in a patient.The environment may also include another device 205. The environment mayalso include a terrestrial or extraterrestrial communication link,illustrated as a communication tower and satellite. In an embodiment,the communication link may include at least one of a wired or a wirelesscommunication link.

The medical apparatus 210 includes a communication module 220, a threatassessment module 230, and a threat mitigation module 260. Thecommunication module includes a communication module configured toreceive communications originated externally of the patient (not shown).For example, a communication originated externally of the patient mayinclude a wireless signal originated by another device 205, such as ahandheld version of the thin computing device 20 of FIG. 1, thecomputing device 110 of FIG. 2, a cell phone, or other communicationoriginating device physically located outside of the patient.

The threat assessment module 230 includes a threat assessment moduleconfigured to ascertain a threat characteristic of a communicationreceived by the communication module. In an embodiment, thecommunication received may include at least one of a received packet,file, data or information. In a further embodiment, the communicationreceived may include at least one of a first communication received inan ordinary course of employing the medical apparatus and a secondcommunication that includes a threat characteristic. In anotherembodiment, the communication received may include at least one of asignal or a modulated carrier. In a further embodiment, thecommunication received may include a communication received in at leastone of an analog format or a digital format.

In an embodiment, a threat characteristic of the communication receivedmay include at least one of a blocking communication, such as noise or ajamming, a failure to receive an expected communication, or anoverwhelming communication, such as a denial of service attack. In afurther embodiment, a threat characteristic of the communicationreceived may include a spyware.

In another embodiment, a threat characteristic of the communicationreceived may include an unauthorized or unregistered executable. In anembodiment, a threat characteristic of the communication received mayinclude a malware. A malware may include malicious software. In anotherembodiment, a malware may include at least one of a virus, worm, orTrojan horse. In an embodiment, the threat characteristic may include anaction the malware may perform on the medical apparatus 210, or on acomputing device associated with the medical apparatus. In anotherembodiment, the threat characteristic may include an attack vector. In afurther embodiment, the threat characteristic may include at least oneof target environment, a carrier object, a transport mechanism, apayload, a trigger mechanism, or a defense mechanism. In anotherembodiment, a payload may include at least one of a backdoor, datacorruption or deletion, information theft, denial of service, systemshutdown, or service disruption.

In a further embodiment, ascertaining a threat characteristic mayinclude identifying a malware present in the communication received. Inanother embodiment, ascertaining a threat characteristic may includeidentifying a malware present in the communication received, and findingthe identified malware's threat characteristic in a look-up table storedin the implantable medical apparatus. In a further embodiment,ascertaining a threat characteristic may include identifying a malwarepresent in the communication received, and obtaining the identifiedmalware's threat characteristic from a device external to the animal. Inan embodiment, the threat characteristic may be ascertaining using atleast one of signature scanning, or heuristic scanning.

The threat mitigation module 260 includes a threat mitigation moduleconfigured to implement a mitigation measure responsive to theascertained threat characteristic of the received communication.

In an alternative embodiment, the medical apparatus 210 may include apatient module 270 configured to engage a physiological aspect of theanimal. In a further embodiment, the animal module includes a patientmodule configured to at least one of interact, relate, act, affect,effect, sense, or couple with a physiological aspect of the animal. Forexample, the patient module may be configured to acquire physiologicalsignals from the heart, such as an electrocardiograph. In anotherexample, the patient module may be configured to both sense and providecardiac signals, such as with a cardiac pacemaker. In a further example,the patient module may be configured to acquire physiological signalsfrom the central nervous system or the peripheral nervous system, suchas with an EEG, or a NIR. In a further example, the patient module maybe configured to monitor at least one of electrical changes, or changesin metabolism reflected by alterations in blood flow, glucosemetabolism, or oxygen extraction. In another example, the patient modulemay be configured to monitor brain systems, and/or provide deep brainstimulation, cortical stimulation, vagus nerve stimulation, or spinalcord stimulation. In a further example, the patient module may beconfigured to monitor physiological conditions and/or changes in a limb,such as pulsoximetry, or blood or tissue pressure. In another example,the patient module may be configured to monitor an animal's metabolites,such as a glucose monitor. In another alternative embodiment, thepatient module includes a patient module configured to sense aphysiological aspect of the patient. For example, a sensed physiologicalaspect may include at least one of a sensed heart rate, heart pacing,acidity, blood chemistry such as pH, pCO2, pO2, blood component,activity state, or body temperature. In another example, the sensedphysiological aspect may include at least one of a drug level, drugconcentration, metabolite level, circulatory physiology such as bloodpressure and cardiac output monitoring devices that communicate withventricular assist devices to pump blood faster or slower, brain signal,perspiration, or movement.

In another embodiment, patient module 270 includes a patient moduleconfigured to provide a therapeutic benefit to the animal. For example,a provided therapeutic benefit may include at least one of providing amedicant, a medicine, a therapeutic substance, a drug eluted by a stent,a stimulation, a blocking, or a heart pacing. In a further embodiment,the patient module is configured to provide a therapeutic benefit bysensing a physiological aspect of the animal and communicating thesensed physiological aspect to an external device that in responseprovides or adjusts a therapeutic benefit. For example, physiologicaldata may be acquired by the patient module and communicated using thecommunication module 220 with an external ventilator (not shown)configured to adjust at least one of the FI02, tidal volume, or rate ofthe breaths of the animal. In another example, the provided therapeuticbenefit may include a non-drug approach, such at least one of anelectrical, gastric, or mechanical approach.

In a further embodiment, the patient module 270 includes a patientmodule configured to engage at least a portion of a brain of the animal.For example, a neural implant, brain implant, or a neural modulator. Inanother embodiment, the patient module includes a neural modulatormodule configured to engage at least a portion of a nervous system ofthe animal. For example, a deep brain stimulator, neural interface, ornerve stimulator. In an embodiment, the patient module includes apatient module configured to acquire data indicative of a physiologicalaspect of the animal. In another embodiment, the patient module includesa control module configured to manage the patient module. In a furtherembodiment, the patient module includes a patient module configured toengage a physiological aspect of the animal and to monitor its ownfunctioning. In another embodiment, the patient module includes apatient module configured to engage a physiological aspect of the animalduring an implementation of the threat mitigation measure responsive tothe ascertained threat characteristic of the received communication.

In an embodiment, the communication module 220 further includes acommunication module configured to send and/or receive data having arelevance to the animal. In another embodiment, the communication moduleincludes a communication module configured to receive communicationoriginating external to the animal and configured to communicate withanother medical apparatus configured for association with the animal.For example, the another medical apparatus configured for associationwith the animal may include another medical apparatus implanted in theanimal. In a further embodiment, the communication module includes acommunication module configured to receive communications originatingexternal to the animal and to receive a communication useful in updatingat least one of the threat assessment module or the threat mitigationmodule. In another embodiment, the threat assessment module includes athreat assessment module configured to ascertain a susceptibly of animplanted medical device to a threat characteristic of a communicationreceived by the communication module.

In an embodiment, the threat assessment module 230 includes a threatassessment module configured to ascertain a threat characteristic of atleast one of a fake communication, a spoofed communication, or a jammingcommunication received by the communication module. In anotherembodiment, the threat assessment module includes a threat assessmentmodule configured to ascertain a threat characteristic of acommunication received by the communication module and to initiate anotification to another apparatus of the ascertained threatcharacteristic. For example, the another apparatus may include at leastone of another implantable or implanted medical apparatus, an externaldevice or apparatus, or a health care provider. In a further embodiment,the threat assessment module includes a threat assessment moduleconfigured to be updatable in vivo and configured to ascertain a threatcharacteristic of a communication received by the communication module.

In another embodiment, the threat assessment module 230 includes athreat assessment module configured to ascertain a threat characteristicin response to a communication received by the communication module andin response to a history of previously ascertained threatcharacteristics. In a further embodiment, the threat assessment moduleincludes a threat assessment module configured to store the ascertainedthreat characteristic. In another embodiment, the threat characteristicmodule includes a threat module configured to provide a storedascertained threat characteristic in response to a query. In a furtherembodiment, the threat assessment module configured to ascertain athreat characteristic of a communication received by the communicationmodule includes a threat assessment module configured to ascertain apresence of a threat characteristic of a communication received by thecommunication module and to ascertain a cessation of the ascertainedthreat characteristic

In an embodiment, the threat mitigation module 260 includes a threatmitigation module configured to implement a selected mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication. In another embodiment, the threat mitigation moduleincludes a threat mitigation module configured to implement a mitigationmeasure responsive to the ascertained threat characteristic of thereceived communication and selected in response to a selectionalgorithm. In a further embodiment, the threat mitigation moduleincludes a threat mitigation module configured to implement a mitigationmeasure selected based on a lookup table. For example, a mitigationmeasure may include establishing a safe mode in the medical apparatus210. In another embodiment, the threat mitigation module includes athreat mitigation module configured to implement a mitigation measureselected according to a function dependent on at least one of a natureof the ascertained threat characteristic of the received communication,a remaining capability of a patient module of the medical apparatus toengage a physiological aspect of the animal, or a remaining life of apower source 274 providing operational power to the medical apparatus.For example, the nature of the ascertained threat characteristic mayinclude an anticipated duration of a threat. By way of further example,a remaining capacity of the patient module may include an amount ofmedicant available for release in the animal.

In an embodiment, the threat mitigation module 260 includes a threatmitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication, the mitigation measure including at least one of anencryption, an encryption change, a disinformation measure, a change ofcommunication frequency, a change of a schedule of communication, aformatting of communication, a communication polarization, a handshake,tunneling, signature, authentication, or verification. In anotherembodiment, the threat mitigation module includes a threat mitigationmodule configured to be updated in vivo and configured to implement amitigation measure responsive to the ascertained threat characteristicof the received communication. In a further embodiment, the threatmitigation module includes a threat mitigation module configured toimplement a mitigation measure. The mitigation measure is responsive tothe ascertained threat characteristic of the received communication andmeeting a minimum safety standard for the animal.

In an embodiment, the threat mitigation module 260 includes a threatmitigation module configured to implement a mitigation measure in atleast one of the patient module 270 or the communication module 220. Themitigation measure is responsive to the ascertained threatcharacteristic of the received communication and meeting a minimumsafety standard for the animal.

In another embodiment, the threat mitigation module includes a threatmitigation module configured to implement a mitigation measure. Themitigation measure responsive to the ascertained threat characteristicof the received communication and predicted to meet a minimum safetystandard for the animal. In a further embodiment, the threat mitigationmodule includes a threat mitigation module configured to implement amitigation measure. The mitigation measure responsive to the ascertainedthreat characteristic of the received communication and selected toprovide the least adverse effect on the animal from among twocountermeasures. In an embodiment, the threat mitigation module includesa threat mitigation module configured to implement a mitigation measureresponsive. The mitigation measure is responsive to the ascertainedthreat characteristic of the received communication and predicted by alookup table as unlikely to have an at least substantial adverse impacton the animal. In another embodiment, the threat mitigation moduleincludes a threat mitigation module configured to implement a mitigationmeasure. The mitigation measure is responsive to the ascertained threatcharacteristic of the received communication and predicted by a lookuptable stored in the implanted medical apparatus as unlikely to have anat least substantial adverse impact on the animal. In a furtherembodiment, the threat mitigation module includes a threat mitigationmodule configured to implement a mitigation measure. The mitigationmeasure is responsive to the ascertained threat characteristic of thereceived communication and unlikely to have an at least substantiallyserious impact on the animal.

In another embodiment, the threat mitigation module 260 includes athreat mitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication and to initiate a notification to another apparatus of theimplemented mitigation measure. In a further embodiment, the threatmitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication includes a threat mitigation module configured to reversethe implementation of the mitigation measure responsive. In anembodiment, the threat mitigation module configured to implement amitigation measure responsive to the ascertained threat characteristicof the received communication includes a threat mitigation moduleconfigured to reverse the implementation of the mitigation measure andto initiate a notification to another apparatus of the reversing theimplementation of the mitigation measure.

In another embodiment, the threat mitigation module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication includes a threat moduleconfigured to implement a mitigation measure responsive to theascertained threat characteristic of the received communication and savean indication of the implemented mitigation measure. In furtherembodiment, the threat mitigation module configured to implement amitigation measure responsive to the ascertained threat characteristicof the received communication includes a threat module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication and provide storedindication of the implemented mitigation measure in response to a query.In an embodiment, the threat mitigation module configured to implement amitigation measure responsive to the ascertained threat characteristicof the received communication includes a threat module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication and a history that includesan ascertained threat characteristic of another received communication.In another embodiment, the threat mitigation module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication includes a threat moduleconfigured to implement a mitigation measure responsive to theascertained threat characteristic of the received communication and ahistory that includes a previously implemented mitigation measure. Infurther embodiment, the threat mitigation module configured to implementa mitigation measure responsive to the ascertained threat characteristicof the received communication includes a threat module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication and an indication of acessation of the ascertained threat characteristic.

In an embodiment, the medical apparatus 210 includes a biocompatiblehousing 272 adapted to be implanted in a mammalian patient (not shown).In another embodiment, the medical apparatus includes the power source296 providing operational power to at least a portion of the medicalapparatus. In another embodiment, the medical apparatus includes abackdoor module 274 configured to respond to a command received from atrusted or a verified third party without regard to the implementedmitigation measure responsive to the ascertained threat characteristicof the received communication. For example, the backdoor module may beconfigured to respond to a control command. By way of further example,the backdoor module may be configured to a command with respect to atleast one of the patient module 270 or the medical apparatus as a whole.In a further embodiment, the medical apparatus may include at least oneof other module(s) 272, processor 292, or an information store 294.

In an alternative embodiment, the medical apparatus 210 of FIG. 3includes a medical apparatus at least a portion of which is configuredfor implantation in an animal. The medical apparatus 210 includes thecommunication module 220, the threat assessment module 230, and thethreat mitigation module 260. The communication module includes acommunication module configured to receive communications originatingexternal to the medical apparatus. For example, a communicationoriginating external to the medical apparatus may include anothermedical apparatus and/or device implanted in the animal (not shown).

FIG. 4 illustrates another example environment 300 in which embodimentsmay be implemented. The example environment includes a medical apparatus302 and another device 305. The medical apparatus is implanted in ananimal 304. The medical apparatus includes a receiver module 310, amalware indication detector module 320, and a countermeasure module 350.In some embodiments, one or more of the receiver module, malwareindication detector module, and countermeasure module may bestructurally distinct from the remaining modules. In another embodiment,the electronic device or a portion of the medical apparatus may beimplemented in whole or in part using the thin computing device 20described in conjunction with FIG. 1, and/or the computing device 110described in conjunction with FIG. 2. In a further embodiment, themedical apparatus or a portion of the medical apparatus may beimplemented using Application Specific Integrated Circuits (ASICs),Field Programmable Gate Arrays (FPGAs), digital signal processors(DSPs), or other integrated formats. In a further embodiment, one ormore of the modules, circuits and/or the apparatus may be implemented inhardware, software, and/or firmware.

The receiver module 310 includes a receiver module configured to atleast one of transmit or receive a communication. In an alternative,embodiment, the receive module is configured to communicate externallyto the animal, such as a communication with another device 305. Thecommunication may be implemented using at least one of a wirelesscommunication link or a wired communication link. The receiver modulemay be operable to communicate with the another device using a network,for example, such as the Internet or a private network. In anotherembodiment, the receiver module is configured to communicate externallyto itself, such as with a second implanted medical apparatus or a device(not shown).

The medical apparatus 302 may include at least one additional module.The at least one additional module may include a notification module390, a patient module 303, a processor 304, an information store 306, apower source 308, or other module(s) 309.

FIG. 5 illustrates an example of an operational flow 400 implemented inan environment. The environment includes a medical apparatus at least aportion of which is implanted in an animal and configured to at leastone of transmit or receive a communication. In an embodiment, themedical apparatus may be adhered to the skin of the animal, or partiallyor wholly implanted in the animal. In another embodiment, the animal mayinclude at least one of a patient, living body, human, animal, mammal,bird, fish, or food stock. The medical apparatus may be implementedusing the medical apparatus 303 implanted in the animal 304 of FIG. 4.FIG. 5 and several following figures may include various examples ofoperational flows, discussions, and explanations with respect to theabove-described environment 300 of FIG. 4, and/or with respect to otherexamples and contexts. However, it should be understood that theoperational flows may be executed in a number of other environments andcontexts, and/or in modified versions of FIG. 4. Also, although thevarious operational flows are illustrated in a sequence(s), it should beunderstood that the various operations may be performed in other ordersthan those which are illustrated, and/or may be performed concurrently.

After a start operation implemented in the environment that includes amedical apparatus implanted in an animal and configured to at least oneof transmit or receive a communication, the operational flow 400includes an acquirement operation 410. The acquirement operationincludes receiving a communication. The acquirement operation may beimplemented using the receiver module 310 of FIG. 4. A demodulationoperation 420 includes detecting an indication of a malware in thereceived communication. In an embodiment, malware may include at leastone of virus, a worm, Trojan horse, a rootkit, spyware, adware, a bufferoverflow, a virus hoax, a dialer, or a hack tool. In another embodiment,a malware may include a program having a threat characteristic. Thedemodulation operation may be implemented using the malware indicationdetection module 320 of FIG. 4. A defense operation 450 includesimplementing in the implanted medical device a countermeasure responsiveto the detected indication of malware in the received communication. Thedefense operation may be implemented using the countermeasure module 350of FIG. 4. The operational flow then proceeds to an end operation.

In an alternative embodiment, the operational flow 400 may include atleast one additional operation. The at least one additional operationmay include a notification operation 490. The notification operationincludes initiating a transmission of an attack notification in responseto the indication of malware in the received communication. In analternative embodiment, the notification operation 490 includes anoperation 492 initiating a transmission of an attack notificationreceivable by a trusted external unit in response to the indication ofmalware in the received communication. The trusted external unit mayinclude the another device 305 of FIG. 4. The notification operation maybe implemented using the notification module 390 of FIG. 4. In anotherembodiment, the notification operation includes initiating a securetransmission of an attack notification in response to the indication ofmalware in the received communication. In a further embodiment, thenotification operation includes initiating a transmission of anindication of the countermeasure implemented in the implanted medicaldevice.

FIG. 6 illustrates an alternative embodiment of the operational flow 400of FIG. 5. The acquirement operation 410 may include at least oneadditional operation. The at least one additional operation may includeat least one of an operation 412, an operation 414, or an operation 416.The operation 412 includes receiving a communication that includes atleast one of instruction, command, data request, or inquiry receivableby the medical device. The operation 414 includes receiving acommunication originated by another device external to the animal. Theoperation 416 includes failing to receive an expected communication. Forexample, failing to receive an expected communication may include atleast one of failing to receive a handshake, an acknowledgement, or ascheduled communication. The operation 416 may include at least oneadditional operation, such as an operation 418. The operation 418includes detecting an indication of a malware in response to the failingto receive an expected communication.

FIG. 7 illustrates another alternative embodiment of the operationalflow 400 of FIG. 5. The demodulation operation 420 may include at leastone additional operation. The at least one additional operation mayinclude at least one of an operation 422, an operation 424, an operation426, an operation 428, an operation 432, an operation 434, or anoperation 436. The operation 422 includes detecting an indication of amalware threat characteristic in the received communication. Theoperation 424 includes detecting an indication of a malware attackstrategy in the received communication. The operation 426 includesdetecting an indication of at least one of a virus, a worm, a Trojanhorse, a rootkit, a spyware, an adware, a buffer overflow, a virus hoax,a dialer, a hack tool, backdoor, data corruption, or data deletion inthe received communication. The operation 428 includes detecting anindication of at least one of an information theft, denial of service,system shut down instruction, unexpected instruction, tampering,spoofing, bandwidth flooding, service disruption, insertion of a falseinstruction, or taking control of an aspect of the medical device in thereceived communication. The operation 432 includes detecting anindication of a malware in the received communication to which theimplanted medical device may be susceptible. The operation 434 includesdetecting an indication that the received communication was receivedfrom a non-trusted source. The operation 436 includes detecting anindication of a malware in the received communication using at least oneof a signature-based detection system, heuristic engine, artificialintelligence, pattern recognition, or malware definition.

FIG. 8 illustrates a further alternative embodiment of the operationalflow 400 of FIG. 5. The defensive operation 450 may include at least oneadditional operation. The at least one additional operation may includeat least one of an operation 452, an operation 454, an operation 456, anoperation 458, and an operation 462. The operation 452 includesimplementing in the implanted medical device a selected countermeasureresponsive to the detected indication of malware in the receivedcommunication. The operation 454 includes implementing in the implantedmedical device a selected countermeasure responsive to the detectedindication of malware in the received communication, wherein theselected countermeasure is selected in response to at least one of aselection algorithm function or a lookup table. The operation 456includes implementing in the implanted medical device a selectedcountermeasure useable in at least substantially reducing a harm causedby a malware, and responsive to the detected indication of malware inthe received communication. The operation 458 includes implementing inthe implanted medical device a countermeasure responsive to a determinedthreat characteristic of the detected indication of malware in thereceived communication. The operation 462 includes implementing in theimplanted medical device a countermeasure responsive to the detectedindication of malware in the received communication, the countermeasureincluding at least one of an encryption, an encryption change, adisinformation measure, a change of communication frequency, a change ofa schedule of communication, formatting a communication, a communicationpolarization, a handshake, tunneling, signature, authentication, orverification.

FIG. 9 illustrates an alternative embodiment of the operational flow 400of FIG. 5. The defensive operation 450 may include at least oneadditional operation. The at least one additional operation may includean operation 464. The operation 464 includes implementing in theimplanted medical device a countermeasure. The countermeasure isresponsive to the detected indication of malware in the receivedcommunication and meeting a minimum safety standard for the animal. Theoperation 464 may include at least one additional operation. The atleast one additional operation may include an operation 466, anoperation 468, an operation 472, an operation 474, an operation 476, oran operation 478. The operation 466 includes implementing in theimplanted medical device a countermeasure. The countermeasure isresponsive to the detected indication of malware in the receivedcommunication and predicted to meet a minimum safety standard for theanimal. The operation 468 includes implementing in the implanted medicaldevice a countermeasure. The countermeasure is responsive to thedetected indication of malware in the received communication andselected to provide a least adverse effect on the animal from among twocountermeasures. The operation 472 includes implementing in theimplanted medical device a countermeasure. The counter measure isresponsive to the ascertained threat characteristic of the receivedcommunication and predicted as unlikely to have an at least substantialadverse impact on the animal. The operation 474 includes in theimplanted medical device a countermeasure. The countermeasure isresponsive to the ascertained threat characteristic of the receivedcommunication and predicted by a lookup table as unlikely to have an atleast substantial adverse impact on the animal. The operation 476includes implementing in the implanted medical device a countermeasure.The countermeasure is responsive to the detected indication of malwarein the received communication and unlikely to cause an adverse reactionin the animal. The operation 478 includes implementing in the implantedmedical device a countermeasure. The countermeasure is responsive to thedetected indication of malware in the received communication andunlikely to have an at least substantially adverse impact on the medicaldevice implanted in the animal. In another embodiment, the operation 464includes implementing in the implanted medical device a countermeasure.The countermeasure is responsive to the detected indication of malwarein the received communication and unlikely to have an at leastsubstantially adverse impact on an operation of the medical deviceimplanted in the animal. In a further embodiment, the operation 464includes implementing in the implanted medical device a countermeasure.The countermeasure is responsive to the detected indication of malwarein the received communication and predicted by at least one of aprediction algorithm or a lookup table as unlikely to cause an adverseoutcome to the animal.

FIG. 10 illustrates an example computer program product 500. Thecomputer program product includes a computer-readable signal-bearingmedium 510 bearing program instructions 520. The program instructionsare configured to perform a process in a computing device of ananimal-implantable medical apparatus. The process includes receiving acommunication originated by a source external to the animal. The processalso includes detecting an indication of a malware in the receivedcommunication. The process further includes implementing in theimplanted medical apparatus a countermeasure responsive to the detectedindication of malware in the received communication.

The program instructions 520 may include at least one alternativeembodiment. The at least one alternative embodiment may include programinstruction 522, a program instruction 524, or program instruction 526.Program instruction 522 includes implementing in the implanted medicalapparatus a countermeasure. The countermeasure is selected in responseto at least one of an algorithm or a lookup table and responsive to thedetected indication of malware in the received communication. The lookuptable may include a locally stored lookup table or a remotely storedlookup table. The program instruction 524 includes implementing in theimplanted medical apparatus a countermeasure responsive to the detectedindication of malware in the received communication, and predicted asunlikely to have an at least substantially adverse impact on the animal.In an embodiment, “predicted as unlikely” may include at least one ofpredicted as unlikely by a lookup table stored in the implanted medicalapparatus, or by a selection algorithm. The program instruction 526includes implementing in the implanted medical apparatus acountermeasure. The countermeasure is responsive to the detectedindication of malware in the received communication and meeting aminimum safety standard for the animal.

In an alternative embodiment, the computer-readable signal-bearingmedium 510 bearing the program instructions includes a computer readablestorage medium 512 bearing the program instructions. In anotheralternative embodiment, the computer-readable signal-bearing mediumbearing the program instructions includes a computer readablecommunication medium 514 bearing the program instructions.

FIG. 11 illustrates an example system 600 in which embodiments may beimplemented. The system includes a medical device 605 configured for atleast partial implantation in a living subject. The medical deviceincludes means 610 for at least one of receiving or transmitting acommunication. In an alternative embodiment, the means 610 is configuredfor receiving or transmitting outside of its self. In anotherembodiment, the means 610 is configured for receiving or transmittingoutside of the living subject. The medical device further includes means620 for detecting an indication of a malware in a receivedcommunication. The medical device further includes means 630 forimplementing in an element of the implanted medical device acountermeasure responsive to the detected indication of malware in thereceived communication. In an alternative embodiment, the medical deviceincludes means 640 for engaging a physiological aspect of the livingsubject.

The foregoing detailed description has set forth various embodiments ofthe systems, apparatus, devices, computer program products, and/orprocesses using block diagrams, flow diagrams, operation diagrams,flowcharts, illustrations, and/or examples. A particular block diagram,operation diagram, flowchart, illustration, environment, and/or exampleshould not be interpreted as having any dependency or requirementrelating to any one or combination of components illustrated therein.For example, in certain instances, one or more elements of anenvironment may be deemed not necessary and omitted. In other instances,one or more other elements may be deemed necessary and added.

Insofar as such block diagrams, operation diagrams, flowcharts,illustrations, and/or examples contain one or more functions and/oroperations, it will be understood that each function and/or operationwithin such block diagrams, operation diagrams, flowcharts,illustrations, or examples can be implemented, individually and/orcollectively, by a wide range of hardware, software, firmware, orvirtually any combination thereof unless otherwise indicated. In anembodiment, several portions of the subject matter described herein maybe implemented via Application Specific Integrated Circuits (ASICs),Field Programmable Gate Arrays (FPGAs), digital signal processors(DSPs), or other integrated formats. However, those skilled in the artwill recognize that some aspects of the embodiments disclosed herein, inwhole or in part, can be equivalently implemented in circuits, as one ormore computer programs running on one or more computers (e.g., as one ormore programs running on one or more computer systems), as one or moreprograms running on one or more processors (e.g., as one or moreprograms running on one or more microprocessors), as firmware, or asvirtually any combination thereof, and that designing the circuitryand/or writing the code for the software and or firmware would be wellwithin the skill of one of skill in the art in light of this disclosure.In addition, those skilled in the art will appreciate that themechanisms of the subject matter described herein are capable of beingdistributed as a program product in a variety of forms, and that anillustrative embodiment of the subject matter described herein appliesregardless of the particular type of signal bearing medium used toactually carry out the distribution. Examples of a signal bearing mediuminclude, but are not limited to, the following: a recordable type mediumsuch as a floppy disk, a hard disk drive, a Compact Disc (CD), a DigitalVideo Disk (DVD), a digital tape, a computer memory, etc.; and atransmission type medium such as a digital and/or an analogcommunication medium (e.g., a fiber optic cable, a waveguide, a wiredcommunication link, a wireless communication link, etc.).

Those having skill in the art will recognize that the state of the arthas progressed to the point where there is little distinction leftbetween hardware and software implementations of aspects of systems; theuse of hardware or software is generally (but not always, in that incertain contexts the choice between hardware and software can becomesignificant) a design choice representing cost vs. efficiency tradeoffs.Those having skill in the art will appreciate that there are variousvehicles by which processes and/or systems and/or other technologiesdescribed herein can be effected (e.g., hardware, software, and/orfirmware), and that the preferred vehicle will vary with the context inwhich the processes and/or systems and/or other technologies aredeployed. For example, if an implementer determines that speed andaccuracy are paramount, the implementer may opt for a mainly hardwareand/or firmware vehicle; alternatively, if flexibility is paramount, theimplementer may opt for a mainly software implementation; or, yet againalternatively, the implementer may opt for some combination of hardware,software, and/or firmware. Hence, there are several possible vehicles bywhich the processes and/or devices and/or other technologies describedherein may be effected, none of which is inherently superior to theother in that any vehicle to be utilized is a choice dependent upon thecontext in which the vehicle will be deployed and the specific concerns(e.g., speed, flexibility, or predictability) of the implementer, any ofwhich may vary. Those skilled in the art will recognize that opticalaspects of implementations will typically employ optically-orientedhardware, software, and or firmware. Those skilled in the art willrecognize that optical aspects of implementations will typically employoptically-oriented hardware, software, and or firmware.

In a general sense, those skilled in the art will recognize that thevarious aspects described herein which can be implemented, individuallyand/or collectively, by a wide range of hardware, software, firmware, orany combination thereof can be viewed as being composed of various typesof “electrical circuitry.” Consequently, as used herein “electricalcircuitry” includes, but is not limited to, electrical circuitry havingat least one discrete electrical circuit, electrical circuitry having atleast one integrated circuit, electrical circuitry having at least oneapplication specific integrated circuit, electrical circuitry forming ageneral purpose computing device configured by a computer program (e.g.,a general purpose computer configured by a computer program which atleast partially carries out processes and/or devices described herein,or a microprocessor configured by a computer program which at leastpartially carries out processes and/or devices described herein),electrical circuitry forming a memory device (e.g., forms of randomaccess memory), and/or electrical circuitry forming a communicationdevice (e.g., a modem, communication switch, or optical-electricalequipment). Those having skill in the art will recognize that thesubject matter described herein may be implemented in an analog ordigital fashion or some combination thereof.

In some embodiments, “configured” includes at least one of designed, setup, shaped, implemented, constructed, or adapted for at least one of aparticular purpose, application, or function. In some embodiment,“module” includes a hardware, firmware, or software component thatinteracts with a larger system. In a further embodiment, a softwaremodule or program module may come in a form of a file and may typicallyhandle a specific task within a larger software system. In anotherembodiment, a hardware module may include a unit that plugs into alarger system. In an embodiment, a module may be implemented in acircuit, such as in a software circuit or an electrical circuit. Inanother embodiment, a module may be implemented in hardware, software,firmware, or any combination thereof.

It will be understood by those within the art that, in general, termsused herein, and especially in the appended claims (e.g., bodies of theappended claims) are generally intended as “open” terms (e.g., the term“including” should be interpreted as “including but not limited to,” theterm “having” should be interpreted as “having at least,” the term“includes” should be interpreted as “includes but is not limited to,”etc.).

It will be further understood by those within the art that if a specificnumber of an introduced claim recitation is intended, such an intentwill be explicitly recited in the claim, and in the absence of suchrecitation no such intent is present. For example, as an aid tounderstanding, the following appended claims may contain usage of theintroductory phrases “at least one” and “one or more” to introduce claimrecitations. However, the use of such phrases should not be construed toimply that the introduction of a claim recitation by the indefinitearticles “a” or “an” limits any particular claim containing suchintroduced claim recitation to inventions containing only one suchrecitation, even when the same claim includes the introductory phrases“one or more” or “at least one” and indefinite articles such as “a” or“an” (e.g., “a” and/or “an” should typically be interpreted to mean “atleast one” or “one or more”); the same holds true for the use ofdefinite articles used to introduce claim recitations. In addition, evenif a specific number of an introduced claim recitation is explicitlyrecited, those skilled in the art will recognize that such recitationshould typically be interpreted to mean at least the recited number(e.g., the bare recitation of “two recitations,” without othermodifiers, typically means at least two recitations, or two or morerecitations).

Furthermore, in those instances where a convention analogous to “atleast one of A, B, and C, etc.” is used, in general such a constructionis intended in the sense one having skill in the art would understandthe convention (e.g., “a system having at least one of A, B, and C”would include but not be limited to systems that have A alone, B alone,C alone, A and B together, A and C together, B and C together, and/or A,B, and C together, etc.). In those instances where a conventionanalogous to “at least one of A, B, or C, etc.” is used, in general sucha construction is intended in the sense one having skill in the artwould understand the convention (e.g., “a system having at least one ofA, B, or C” would include but not be limited to systems that have Aalone, B alone, C alone, A and B together, A and C together, B and Ctogether, and/or A, B, and C together, etc.). It will be furtherunderstood by those within the art that virtually any disjunctive wordand/or phrase presenting two or more alternative terms, whether in thedescription, claims, or drawings, should be understood to contemplatethe possibilities of including one of the terms, either of the terms, orboth terms. For example, the phrase “A or B” will be understood toinclude the possibilities of “A” or “B” or “A and B.”

The herein described aspects depict different components containedwithin, or connected with, different other components. It is to beunderstood that such depicted architectures are merely examples, andthat in fact many other architectures can be implemented which achievethe same functionality. In a conceptual sense, any arrangement ofcomponents to achieve the same functionality is effectively “associated”such that the desired functionality is achieved. Hence, any twocomponents herein combined to achieve a particular functionality can beseen as “associated with” each other such that the desired functionalityis achieved, irrespective of architectures or intermedial components.Likewise, any two components so associated can also be viewed as being“operably connected,” or “operably coupled,” to each other to achievethe desired functionality. Any two components capable of being soassociated can also be viewed as being “operably couplable” to eachother to achieve the desired functionality. Specific examples ofoperably couplable include but are not limited to physically mateableand/or physically interacting components and/or wirelessly interactableand/or wirelessly interacting components.

While various aspects and embodiments have been disclosed herein, otheraspects and embodiments will be apparent to those skilled in the art.The various aspects and embodiments disclosed herein are for purposes ofillustration and are not intended to be limiting, with the true scopeand spirit being indicated by the following claims.

1. A medical apparatus at least a portion of which is configured forimplantation in an animal, the medical apparatus comprising: acommunication module configured to receive communications originatingexternal to the animal; a threat assessment module configured toascertain a threat characteristic of a communication received by thecommunication module; and a threat mitigation module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication.
 2. The medical apparatusof claim 1, wherein the medical apparatus further includes: a patientmodule configured to engage a physiological aspect of the animal.
 3. Themedical apparatus of claim 2, wherein the patient module configured toengage a physiological aspect of the animal includes: a patient moduleconfigured to at least one of interact, relate, act, affect, effect,sense, or couple with a physiological aspect of the animal.
 4. Themedical apparatus of claim 2, wherein the patient module configured toengage a physiological aspect of the animal includes: a patient moduleconfigured to provide a therapeutic benefit to the animal.
 5. Themedical apparatus of claim 2, wherein the patient module configured toengage a physiological aspect of the animal includes: a patient moduleconfigured to sense a physiological aspect of the animal.
 6. The medicalapparatus of claim 2, wherein the patient module configured to engage aphysiological aspect of the animal includes: a patient module configuredto engage at least a portion of a brain of the animal.
 7. The medicalapparatus of claim 2, wherein the patient module configured to engage aphysiological aspect of the animal includes: a neural modulator moduleconfigured to engage at least a portion of a nervous system of theanimal.
 8. The medical apparatus of claim 2, wherein the patient moduleconfigured to engage a physiological aspect of the animal includes: apatient module configured to acquire data indicative of a physiologicalaspect of the animal.
 9. The medical apparatus of claim 2, wherein thepatient module configured to engage a physiological aspect of the animalincludes: a control module configured to manage the patient module. 10.The medical apparatus of claim 2, wherein the patient module configuredto engage a physiological aspect of the animal includes: a patientmodule configured to engage a physiological aspect of the animal and tomonitor its own functioning.
 11. The medical apparatus of claim 2,wherein the patient module configured to engage a physiological aspectof the animal includes: a patient module configured to engage aphysiological aspect of the animal during an implementation of thethreat mitigation measure responsive to the ascertained threatcharacteristic of the received communication.
 12. The medical apparatusof claim 1, wherein the communication module configured to receivecommunications originating external to the animal includes: acommunication module configured to send and/or receive data having arelevance to the animal.
 13. The medical apparatus of claim 1, whereinthe communication module configured to receive communicationsoriginating external to the animal includes: a communication moduleconfigured to receive communications originating external to the animaland configured to communicate with another medical apparatus configuredfor association with the animal.
 14. The medical apparatus of claim 1,wherein the communication module configured to receive communicationsoriginating external to the animal includes: a communication moduleconfigured to receive communications originating external to the animaland to receive a communication useful in updating at least one of thethreat assessment module or the threat mitigation module.
 15. Themedical apparatus of claim 1, wherein the threat assessment moduleconfigured to ascertain a threat characteristic of a communicationreceived by the communication module includes: a threat assessmentmodule configured to ascertain a susceptibly of the medical device to athreat characteristic of a communication received by the communicationmodule.
 16. The medical apparatus of claim 1, wherein the threatassessment module configured to ascertain a threat characteristic of acommunication received by the communication module includes: a threatassessment module configured to ascertain a threat characteristic of atleast one of a fake communication, a spoofed communication, or a jammingcommunication received by the communication module.
 17. The medicalapparatus of claim 1, wherein the threat assessment module configured toascertain a threat characteristic of a communication received by thecommunication module includes: a threat assessment module configured toascertain a threat characteristic of a communication received by thecommunication module and to initiate a notification to another apparatusof the ascertained threat characteristic.
 18. The medical apparatus ofclaim 1, wherein the threat assessment module configured to ascertain athreat characteristic of a communication received by the communicationmodule includes: a threat assessment module configured to ascertain apresence of a threat characteristic of a communication received by thecommunication module and to ascertain a cessation of the ascertainedthreat characteristic.
 19. The medical apparatus of claim 1, wherein thethreat assessment module configured to ascertain a threat characteristicof a communication received by the communication module includes: athreat assessment module configured to be updatable in vivo andconfigured to ascertain a threat characteristic of a communicationreceived by the communication module.
 20. The medical apparatus of claim1, wherein the threat mitigation module configured to implement amitigation measure responsive to the ascertained threat characteristicof the received communication includes: a threat mitigation moduleconfigured to implement a selected mitigation measure responsive to theascertained threat characteristic of the received communication.
 21. Themedical apparatus of claim 1, wherein the threat mitigation moduleconfigured to implement a mitigation measure responsive to theascertained threat characteristic of the received communicationincludes: a threat mitigation module configured to implement amitigation measure responsive to the ascertained threat characteristicof the received communication and selected in response to a selectionalgorithm.
 22. The medical apparatus of claim 1, wherein the threatmitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication includes: a threat mitigation module configured toimplement a mitigation measure selected based on to a lookup table. 23.The medical apparatus of claim 1, wherein the threat mitigation moduleconfigured to implement a mitigation measure responsive to theascertained threat characteristic of the received communicationincludes: a threat mitigation module configured to implement amitigation measure selected according to a function dependent on atleast one of a nature of the ascertained threat characteristic of thereceived communication, a remaining capability of a patient module ofthe medical apparatus to engage a physiological aspect of the animal, ora remaining life of a power source providing operational power to themedical apparatus.
 24. The medical apparatus of claim 1, wherein thethreat mitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication includes: a threat mitigation module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication, the mitigation measureincluding at least one of an encryption, an encryption change, adisinformation measure, a change of communication frequency, a change ofa schedule of communication, formatting a communication, a communicationpolarization, a handshake, tunneling, signature, authentication, orverification.
 25. The medical apparatus of claim 1, wherein the threatmitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication includes: a threat mitigation module configured to beupdatable in vivo and configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication.
 26. The medical apparatus of claim 1, wherein the threatmitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication includes: a threat mitigation module configured toimplement a mitigation measure, the mitigation measure responsive to theascertained threat characteristic of the received communication andmeeting a minimum safety standard for the animal.
 27. The medicalapparatus of claim 26, wherein the threat mitigation module configuredto implement a mitigation measure includes: a threat mitigation moduleconfigured to implement a mitigation measure in at least one of thepatient module or the communication module, the mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication and meeting a minimum safety standard for the animal. 28.The medical apparatus of claim 26, wherein the threat mitigation moduleconfigured to implement a mitigation measure includes: a threatmitigation module configured to implement a mitigation measure, themitigation measure responsive to the ascertained threat characteristicof the received communication and predicted to meet a minimum safetystandard for the animal.
 29. The medical apparatus of claim 26, whereinthe threat mitigation module configured to implement a mitigationmeasure includes: a threat mitigation module configured to implement amitigation measure, the mitigation measure responsive to the ascertainedthreat characteristic of the received communication and selected toprovide a least adverse effect on the animal from among twocountermeasures.
 30. The medical apparatus of claim 26, wherein thethreat mitigation module configured to implement a mitigation includes:a threat mitigation module configured to implement a mitigation measure,the mitigation measure responsive to the ascertained threatcharacteristic of the received communication and predicted by a lookuptable as unlikely to have an at least substantial adverse impact on theanimal.
 31. The medical apparatus of claim 26, wherein the threatmitigation module configured to implement a mitigation includes: athreat mitigation module configured to implement a mitigation measure,the mitigation measure responsive to the ascertained threatcharacteristic of the received communication and predicted by a lookuptable stored in the implanted medical apparatus as unlikely to have anat least substantial adverse impact on the animal.
 32. The medicalapparatus of claim 1, wherein the threat mitigation module configured toimplement a mitigation measure responsive to the ascertained threatcharacteristic of the received communication includes: a threatmitigation module configured to implement a mitigation measure, themitigation measure responsive to the ascertained threat characteristicof the received communication and unlikely to have an at leastsubstantially serious impact on the animal.
 33. The medical apparatus ofclaim 1, wherein the threat mitigation module configured to implement amitigation measure responsive to the ascertained threat characteristicof the received communication includes: a threat mitigation moduleconfigured to implement a mitigation measure responsive to theascertained threat characteristic of the received communication and toinitiate a notification to another apparatus of the implementedmitigation measure.
 34. The medical apparatus of claim 1, wherein thethreat mitigation module configured to implement a mitigation measureresponsive to the ascertained threat characteristic of the receivedcommunication includes: a threat mitigation module configured to reversethe implementation of the mitigation measure.
 35. The medical apparatusof claim 1, wherein the threat mitigation module configured to implementa mitigation measure responsive to the ascertained threat characteristicof the received communication includes: a threat mitigation moduleconfigured to reverse the implementation of the a mitigation measure andto initiate a notification to another apparatus of the reversing of theimplementation of the mitigation measure.
 36. The medical apparatus ofclaim 1, further comprising: a biocompatible housing adapted to beimplanted in a mammalian patient.
 37. The medical apparatus of claim 1,further comprising: a power source providing operational power to atleast a portion of the medical apparatus.
 38. The medical apparatus ofclaim 1, further comprising: a backdoor module configured to respond toa command received from a trusted or a verified third party withoutregard to the implemented mitigation measure responsive to theascertained threat characteristic of the received communication.